Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-11-2024 22:43
General
-
Target
551f60af50261f7de85d44ade14e5b2d5d20898bb6857800146afd999c382cc2.exe
-
Size
1.1MB
-
MD5
d8c6c5a637ea0824a1ca4f2894fdac2c
-
SHA1
8c85248155b2a532c28bb74cb1e11a38e58bc11a
-
SHA256
551f60af50261f7de85d44ade14e5b2d5d20898bb6857800146afd999c382cc2
-
SHA512
7033b40df16f492b74c7cf0ebcc9b32b957b33a669d967321ece21542385fd1964a0ccd329f17734a02e3af049362349eab598dcc96ba137851d14c04b913e38
-
SSDEEP
12288:UMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ez7HpXRikZsYGAn2F:UnsJ39LyjbJkQFMhmC+6GD9KrzhK
Malware Config
Extracted
xred
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
-
Xred
Xred is backdoor written in Delphi.
-
Xred family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\551f60af50261f7de85d44ade14e5b2d5d20898bb6857800146afd999c382cc2.exe"C:\Users\Admin\AppData\Local\Temp\551f60af50261f7de85d44ade14e5b2d5d20898bb6857800146afd999c382cc2.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_551f60af50261f7de85d44ade14e5b2d5d20898bb6857800146afd999c382cc2.exe"C:\Users\Admin\AppData\Local\Temp\._cache_551f60af50261f7de85d44ade14e5b2d5d20898bb6857800146afd999c382cc2.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\._cache_551f60af50261f7de85d44ade14e5b2d5d20898bb6857800146afd999c382cc2.exe"C:\Users\Admin\AppData\Local\Temp\._cache_551f60af50261f7de85d44ade14e5b2d5d20898bb6857800146afd999c382cc2.exe"2⤵
- Executes dropped EXE
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d8c6c5a637ea0824a1ca4f2894fdac2c
SHA18c85248155b2a532c28bb74cb1e11a38e58bc11a
SHA256551f60af50261f7de85d44ade14e5b2d5d20898bb6857800146afd999c382cc2
SHA5127033b40df16f492b74c7cf0ebcc9b32b957b33a669d967321ece21542385fd1964a0ccd329f17734a02e3af049362349eab598dcc96ba137851d14c04b913e38
-
Filesize
402KB
MD538455c10da98cfeecbbf6b8007684ce6
SHA11a3c030e5eb88294177fc4dd44348d60135d64cc
SHA256339238369f9063cfde9f40463ba5de146b3b2fce6d5ad5a8ddf3dcb0cfed877f
SHA51211162370b016451a96fba5ee09bca4025c77dc2b1f1b71cc83a13eabafd382638344e5aea753f8784db820840ae53023945ecb516c6be2fd31c2bac068fd61d6
-
Filesize
22KB
MD5fa5dce789d2ab540d302d3cfe462dae1
SHA1fc448434cc7f353e8b423cee2b2c8356b5b531fa
SHA256de4154f66ef677458c8e8e3281e99997466b143597093652b501bc3f6725b8cc
SHA512a670df5312b4632c907c9795c1343b7014b29e64dc8a731b2ee5f8bd5707cdb80e45c937b0532837ffd1f0104cb2b44e166bf8702a057436a6a98bd3b6e5d3ee
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB